When running SharePoint on Server 2008 and using a Network Load Balancing (NLB) cluster, the following warning messages may sporadically appear in the System event log:

SOURCE: NLB
Event ID: 105
NLB cluster []: Timer starvation has been detected. This might be due to a denial of service attack or a very high server load. During this period some connections might fail. If this problem recurs frequently, analyze the threat and take appropriate measures and/or add more servers to the cluster. An informational message event log entry will be logged when the attack has subsided.

Shortly after the warning message, the informational event will get logged:

SOURCE: NLB
Event ID: 106
NLB cluster []: Timer starvation has subsided

Information regarding this problem is discussed in Microsoft Support Knowledge Base article 951037. Basically, Server 2008 introduces a TCP Chimney Offload feature and it's incompatible with NLB. To turn off the TCP Chimney feature:

• Open a Command Prompt
• Run the following command: netsh int tcp set global chimney=disabled
• Close the Command Prompt
• Open Network and Sharing Center (Start -> Control Panel -> Network and Sharing Center)
• Click Manage Network Connections
• Right click the NLB NIC and select Properties
• Click the Configure button
• Click the Advanced tab
• Look for TCP Offload properties in the list on the left and change their value to Disabled

Offload properties will vary by NIC. Look for things like:

• IPv4 Checksum Offload
• IPv4 TSO Offload
• TCP Checksum Offload
• UDP Checksum Offload